Wireless intrusion detection system and method

• US 7,853,250 B2
• Filed: 04/03/2003
• Issued: 12/14/2010
• Est. Priority Date: 04/03/2003
• Status: Active Grant

• Current Assignee: Ozmo Licensing LLC
• Original Assignee: Network Security Technologies, Inc. (Verizon Communications Inc.)
• Inventors: Harvey, Elaine, Walnock, Matthew
• Primary Examiner(s): Cumming; William D
• Application Number:
  US10/405,499
• Publication Number:
  US 20040198392A1
• Time in Patent Office: 2,812 Days
• Field of Search: 455/456.1, 455/561, 455/424, 455/421, 455/452.1, 455/457, 709/206, 709/260, 342/450, 342/457, 725/5, 713/201, 340/568.1, 370/260, 370/338, 726/1, 726/14, 380/270
• US Class Current: 455/421
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A wireless access device in a wireless network, whether a known or unknown entity, can be located using a geolocation system. A signal strength is determined by a wireless intrusion detection system (WIDS) node in a wireless network for each wireless access device that it detects. Based on the signal strength, an approximate distance from the node is determined, which, in one embodiment corresponds to a radius of a circle around the node. To account for error, an approximation band of the circle is calculated that will allow a user to determine the approximate location of the device within the wireless network.

Claims

1. A method, performed by a wireless intrusion detection system, comprising:

determining, by a processor of the wireless intrusion detection system, locations of a plurality of wireless access devices;

comparing, by the processor, said locations of said plurality of wireless access devices to policy elements applicable to said plurality of wireless access devices; and

creating, by the processor, an alert if a wireless access device of said plurality of wireless access devices violates more than a threshold number of said policy elements.

2. A method as in claim 1, where said determining further comprises determining approximate locations of the plurality of wireless access devices.

3. A method as in claim 1, where each policy element is selected from a group including fixed wireless access device location, moving wireless access device, movable wireless access device, or unknown wireless access device.

4. The method of claim 1 where the plurality of wireless access devices includes a wireless access point.

5. The method of claim 1 where the plurality of wireless access devices includes a wireless client device.

6. The method of claim 1 where the determining includes:

determining the locations of the plurality of wireless access devices using triangulation.

7. A wireless intrusion detection system comprising:

a memory to store instructions; and

a processor to execute the instructions to;

determine locations of a plurality of wireless access devices;

compare the locations of the plurality of wireless access devices to policy elements applicable to the plurality of wireless access devices; and

create an alert if a wireless access device of the plurality of wireless access devices violates more than a threshold number of the policy elements.

8. The system as in claim 7, where, when determining locations, the processor is to:

determine approximate locations of the plurality of wireless access devices.

9. The system of claim 7, where the plurality of wireless access devices includes a wireless access point.

10. The system of claim 7, where the plurality of wireless access devices includes a wireless client device.

11. The system of claim 7, where, when determining locations, the processor is to:

determine the locations of the plurality of wireless access devices using triangulation.